Multi-character cost-effective and high throughput architecture for content scanning

String matching is a time and resource consuming operation that lies at the core of Network Intrusion Detection Systems. In this paper a method and corresponding hardware architecture for string matching is presented. The proposed method is composed of two main steps. The first step performs a pre-d...

Full description

Saved in:
Bibliographic Details
Published in:Microprocessors and microsystems 2013-11, Vol.37 (8), p.1200-1207
Main Authors: Bande, José M., Hernández Palancar, José, Cumplido, René
Format: Article
Language:English
Subjects:
Content scanning
FPGA
NIDS
String matching
Unique substrings
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:String matching is a time and resource consuming operation that lies at the core of Network Intrusion Detection Systems. In this paper a method and corresponding hardware architecture for string matching is presented. The proposed method is composed of two main steps. The first step performs a pre-detection of signatures alignment, and in the second step the alignment is corrected and the signatures are detected by a matcher. The compact and efficient architecture is designed to share resources among several modules that perform the detection and correction step needed for the string matching. Implementation results in a FPGA Virtex5 device show that the proposed architecture can perform string matching with a database with more than 400K characters. And is also capable of achieving speeds of more than 30Gbps, which is much higher that previous works reported in the literature.
ISSN:0141-9331
1872-9436
DOI:10.1016/j.micpro.2013.08.001